1. Field of the Invention
The present invention relates to an improved data processing system and, in particular, to a method and apparatus for multicomputer data transferring. Still more particularly, the present invention provides a method and apparatus for computer-to-computer authentication.
2. Description of Related Art
Concerns about the integrity and privacy of electronic communication have grown with adoption of Internet-based services. Various encryption and authentication technologies have been developed to protect electronic communication, such as asymmetric encryption keys.
The X.509 set of standards for digital certificates has been promulgated to create a common, secure, computational framework that incorporates the use of cryptographic keys. An X.509 digital certificate is an International Telecommunications Union (ITU) standard that has been adopted by the Internet Engineering Task Force (IETF) body. It cryptographically binds the certificate holder, presumably the subject name within the certificate, with its public cryptographic key. This cryptographic binding is based on the involvement of a trusted entity within the Internet Public Key Infrastructure for X.509 certificates (PKIX) called the certifying authority (CA). As a result, a strong and trusted association between the certificate holder and its public key can become public information yet remain tamper-proof and reliable. An important aspect of this reliability is a digital signature that the certifying authority stamps on a certificate before it is released for use. Subsequently, whenever the certificate is presented to a system for use of a service, its signature is verified before the subject holder is authenticated. After the authentication process is successfully completed, the certificate holder may be provided access to certain information, services, or other controlled resources, i.e. the certificate holder may be authorized to access certain systems.
PKIX essentially creates and manages two different but closely related constructs: an X.509 certificate and an X.509 Certificate Revocation List (CRL). As noted above, a digital certificate provides an assurance, i.e. a certification, for a public key of the subject holding the certificate, whereas a CRL is the means by which a certifying authority announces the dissolution of the binding represented in a certificate. In other words, a CRL is the means by which the certifying authority declares that a previously issued yet unexpired certificate is no longer valid. Certificates are revoked for a variety of administrative reasons, such as a change in the subject's affiliation with an organization, or security reasons, such as when the security of the certificate or an associated key has been compromised in some manner, such as loss, theft, or unauthorized disclosure of the private key. Certificates that have been revoked are permanently invalidated; they cannot be unrevoked, resumed, reinstated, or otherwise reactivated. An issuing authority certifies a holder's public key by cryptographically signing the certificate data structure. Similarly, the revocation process is also certified by stamping the certifying authority's signature in the CRL data structure.
In order to properly validate a digital certificate, an application must check whether the certificate has been revoked. When the certifying authority issues the certificate, the certifying authority generates a unique serial number by which the certificate is to be identified, and this serial number is stored within the “Serial Number” field within an X.509 certificate. Typically, a revoked X.509 certificate is identified within a CRL via the certificate's serial number; a revoked certificate's serial number appears within a list of serial numbers within the CRL. Hence, an application that is validating a certificate must examine any certificate revocation lists that are potentially relevant to the certificate in order to determine whether the certificate has been revoked. In particular, any CRLs that have been recently published by the certificate authority that issued the certificate must be examined.
A certificate authority typically publishes a new CRL whenever a certificate is revoked. CRLs can be distributed to certificate-validating systems through a variety of mechanisms, but due to potential problems with pushing information to subscriber systems, commercial PKIX systems usually rely on a polling mechanism in which a certificate-validating application has the responsibility of polling for CRLs. The certificate authority can put newly published CRLs into particular locations, such as an LDAP (Lightweight Directory Access Protocol) directory, and this particular location is specified in the certificates that are issued by a certificate authority. However, checking CRLs for each certificate that is being processed by each certificate-using application can have a big performance impact on these applications.
In lieu of or in addition to checking for a CRL, a standard for the Online Certificate Status Protocol (OCSP) has been promulgated. The use of OCSP requires each certificate-using application to contact a server to get the status of a certificate, e.g., current, expired, or unknown. An OCSP client issues a status request to an OCSP responder and suspends acceptance of a certificate until the responder returns a response. In some circumstances, the availability of an OCSP responder may suffer from the overwhelming burden of numerous OCSP status requests.
Therefore, it would be advantageous to have a method and system that for configuring a set of OCSP responders in order to improve the availability of each of the OCSP responders.